Details have emerged about a high severity security vulnerability affecting a software driver used in HP, Xerox, and Samsung printers that has remained undetected since 2005.
Tracked as CVE-2021-3438 (CVSS score: 8.8), the issue concerns a buffer overflow in a print driver installer package named “SSPORT.SYS” that can enable remote privilege and arbitrary code execution. Hundreds of millions of printers have been released worldwide to date with the vulnerable driver in question.
However, there is no evidence that the flaw was abused in real-world attacks.
“A potential buffer overflow in the software drivers for certain HP LaserJet products and Samsung product printers could lead to an escalation of privilege,” according to an advisory published in May.
The issue was reported to HP by threat intelligence researchers from SentinelLabs on February 18, 2021, following which remedies have been published for the affected printers as of May 19, 2021.
Specifically, the issue hinges on the fact that the printer driver doesn’t sanitize the size of the user input, potentially allowing an unprivileged user to escalate privileges and run malicious code in kernel mode on systems that have the buggy driver installed. now
“The vulnerable function inside the driver accepts data sent from User Mode via IOCTL (Input/Output Control) without validating the size parameter,” SentinelOne researcher Asaf Amir said in a report shared with The Hacker News. “This function copies a string from the user input using ‘strncpy‘ with a size parameter that is controlled by the user. Essentially, this allows attackers to overrun the buffer used by the driver.”
Interestingly, it appears that HP copied the driver’s functionality from a near-identical Windows driver sample published by Microsoft, although the sample project in itself doesn’t contain the vulnerability.
This is not the first time security flaws have been discovered in old software drivers. Earlier this May, SentinelOne revealed details about multiple critical privilege escalation vulnerabilities in Dell’s firmware update driver named “dbutil_2_3.sys” that went undisclosed for more than 12 years.
Four Chinese nationals were indicted over separate hacking activity; dozens of nations condemn Beijing’s state-sponsored hacking
WASHINGTON—The Biden administration publicly blamed hackers affiliated with China’s main intelligence service for a far-reaching cyberattack on Microsoft Corp. email software this year, part of a global effort by dozens of nations to condemn Beijing’s malicious cyber activities.
The U.S. government has high confidence that hackers tied to the Ministry of State Security, or MSS, carried out the unusually indiscriminate hack of Microsoft Exchange Server software that emerged in March, senior officials said.
In addition, four Chinese nationals were indicted over a range of separate hacking intrusions dating back a decade that allegedly stole corporate and research secrets from firms and universities around the world. Three of the nationals were described as MSS officers, while a fourth was said to be employed at a Chinese front company that aided the hacking.
“The United States and countries around the world are holding the People’s Republic of China (PRC) accountable for its pattern of irresponsible, disruptive, and destabilizing behavior in cyberspace, which poses a major threat to our economic and national security,” Secretary of State Antony Blinken said Monday. The MSS, he added, had “fostered an ecosystem of criminal contract hackers who carry out both state-sponsored activities and cybercrime for their own financial gain.”
The Microsoft hack made an estimated hundreds of thousands of mostly small businesses and organizations vulnerable to cyber intrusion.
The U.K. and European Union, among others, joined in the attribution of the Microsoft Exchange Server hacking activity, which rendered an estimated hundreds of thousands of mostly small businesses and organizations vulnerable to cyber intrusion. Attributing the Microsoft hack to China was part of a broader global censure Monday of Beijing’s cyberattacks by the U.S., the EU, the U.K., Canada, Australia, New Zealand, Japan and the North Atlantic Treaty Organization, or NATO, a 30-nation alliance.
Biden administration officials called the collective condemnation the largest international effort yet to criticize Beijing’s state-sponsored hacking. While statements varied, the international cohort generally called out China for engaging in harmful cyber activity, including intellectual property theft.
The public shaming, however, didn’t include punitive measures, such as sanctions or diplomatic expulsions by the U.S. That stands in contrast with how the administration recently punished Russia for a range of alleged malicious cyber activity, and the discrepancy drew criticism from some cybersecurity specialists.
The lack of further punishment “looks like a double standard compared with actions against Russian actors. We treat China with kid gloves,” said Dmitri Alperovitch, chairman of Silverado Policy Accelerator, a Washington-based think tank that works to modernize U.S. cybersecurity strategy.
A senior official that said the administration is aware that no single action is capable of changing the Chinese government’s malicious cyber behavior, and that the focus was on bringing countries together in a unified stance against Beijing. The official said that hackers linked to the MSS were using criminal contractors to conduct “unsanctioned” cyber operations globally.
Asked by reporters what he believes the difference is between hacking originating in China and Russia, President Biden said, “My understanding is that the Chinese government, not unlike the Russian government, is not doing this themselves, but are protecting those who are doing it, and maybe even accommodating them being able to do it.”
The U.S.-led announcement is the most significant action from the Biden administration to date concerning China’s yearslong campaign of cyberattacks against the U.S. government and American companies, often involving routine nation-state espionage and the theft of valuable intellectual property such as naval technology and coronavirus-vaccine data.
The indictment the Justice Department made public Monday alleges that the Chinese government has done little to uphold a 2015 accord between China and the Obama Administration not to direct or support cyberattacks that steal corporate records for economic benefit. The Trump administration had also said Beijing repeatedly violated the accord. The indictment, which dates from May, accuses a regional branch of the MSS of relying on a front company, whose payroll was coordinated through a local university, to continue such attacks after the pact was signed.
The indictment charges the four men with orchestrating a hacking campaign from 2011 to 2018 intended to benefit China’s companies and commercial sectors by stealing intellectual property and business information. The indictment didn’t appear directly related to the Microsoft Exchange Server breach, but accused the hackers of stealing information from dozens of companies and universities around the world about Ebola virus research, maritime research and other topics.
U.S. authorities have accused China of widespread hacking targeting American businesses and government agencies for years. China has historically denied the allegations.
“The U.S. has repeatedly made groundless attacks and malicious smear against China on cybersecurity,” Liu Pengyu, spokesman for the Chinese Embassy in Washington, said late Monday. “This is just another old trick, with nothing new in it.”
The Exchange Server hack was disclosed by Microsoft in March alongside a software patch to fix the bugs being exploited in the attack. Microsoft at the time identified the culprits as a Chinese cyber-espionage group with state ties that it refers to as Hafnium, an assessment that was supported by other cybersecurity researchers. The Biden administration hadn’t offered attribution until now, and it is essentially agreeing with the conclusions of the private sector and providing a more detailed identification.
The attack on the Exchange Server systems began slowly and stealthily in early January by hackers who in the past had targeted infectious-disease researchers, law firms and universities, according to cybersecurity officials and analysts. But the operational tempo appeared to intensify as other China-linked hacking groups became involved, infecting thousands of servers as Microsoft worked to send its customers a software patch in early March.
Microsoft praised Monday’s global action. “Attributions like these will help the international community ensure those behind indiscriminate attacks are held accountable,” said Tom Burt, Microsoft’s vice president of customer security and trust.
Also on Monday, the National Security Agency, Federal Bureau of Investigation and Cybersecurity and Infrastructure Security Agency jointly published technical details of more than 50 tactics and techniques favored by hackers linked to the Chinese government. The release of such lists is common when the U.S. exposes or highlights malicious hacking campaigns and is intended to help businesses and critical infrastructure operators better protect their computer systems.
Cybersecurity experts have been pressing the Biden administration for months to respond to China’s alleged involvement in the Microsoft email hack.
“The Microsoft Exchange hacks by MSS contractors is the most reckless cyber operation we have yet seen from the Chinese actors—much more dangerous than the Russian SolarWinds hacks,” said Silverado’s Mr. Alperovitch, referring to the widespread cyber-espionage campaign detected last December that, along with other alleged activities, prompted a suite of punitive measures against Moscow.
Many analysts said the Biden administration broke with years of U.S. foreign policy that tolerated cyber espionage as an acceptable form of 21st century spycraft when it punished Russia earlier this year for SolarWinds.
Kellen Dwyer, a former career prosecutor who served last year as deputy assistant attorney general in the Justice Department’s national security division, said the SolarWinds attack “was an espionage attack, and one that was relatively cautious about imposing collateral damage.”
Meanwhile, said Mr. Dwyer, the Chinese actors who allegedly engaged in the Microsoft Exchange hack grabbed vast swaths of data and “indiscriminately scanned the entire internet to find unpatched vulnerabilities.” He said: “That certainly should be a norm that we are willing to define and meet with sanctions.”
The Chinese defendants charged in the new indictment aren’t in U.S. custody. Some cybersecurity experts have said indictments against foreign state-backed hackers often have little impact, because the accused are rarely brought before an American courtroom. U.S. officials have defended the practice, saying it helps convince allied governments, the private sector and others about the scope of the problem.
The hackers are accused of breaching dozens of schools, companies, and government agencies around the world, ranging from a research facility in California and Florida focused on virus treatments and vaccines, to a Swiss chemicals company that produces maritime paints, to a Pennsylvania university with a robotics engineering program and the National Institutes of Health, to two Saudi Arabian government ministries. The companies and universities aren’t named in the indictment.
The hackers allegedly used fake spear-phishing emails and stored stolen data on GitHub, concealing the files in photos of a koala and Donald Trump, the indictment said. They coordinated with professors at a Chinese university, including to identify and recruit hackers for their campaign, and used the address of the university library as the front company’s location, it said.
WASHINGTON, July 2 (Reuters) – Hundreds of American businesses were hit Friday by an unusually sophisticated ransomware attack that hijacked widely used technology management software from a Miami-based supplier called Kaseya.
The attackers changed a Kaseya tool called VSA, used by companies that manage technology at smaller businesses. They then encrypted the files of those providers’ customers simultaneously.
Security firm Huntress said it was tracking eight managed service providers that had been used to infect some 200 clients.
Kaseya said on its own website that it was investigating a “potential attack” on VSA, which is used by IT professionals to manage servers, desktops, network devices and printers.
It said it shut down some of its infrastructure in response and that it was urging customers that used VSA on their premises to immediately turn off their servers.
“This is a colossal and devastating supply chain attack,” Huntress senior security researcher John Hammond said in an email, referring to an increasingly high profile hacker technique of hijacking one piece of software to compromise hundreds or thousands of users at a time.
Hammond added that because Kaseya is plugged in to everything from large enterprises to small companies “it has the potential to spread to any size or scale business.” Many managed service providers use VSA, although their customers may not realize it, experts said.
Some employees at service providers said on discussion boards that their clients had been hit before they could get a warning to them.
Reuters was not able to reach a Kaseya representative for further comment. Huntress said it believed the Russia-linked REvil ransomware gang – the same group of actors blamed by the FBI for paralyzing meat packer JBS (JBSS3.SA) last month – was to blame for the latest ransomware outbreak.
DEMANDS FOR RANSOM
A private security executive working on the response effort said that ransom demands accompanying the encryption ranged from a few thousand dollars to $5 million or more.
The corruption of an update process shows a marked escalation in sophistication from most ransomware attacks, which take advantage of security loopholes such as common passwords without two-factor authentication.
An email sent to the hackers seeking comment was not immediately returned. In a statement, the U.S. Cybersecurity and Infrastructure Security Agency said it was “taking action to understand and address the recent supply-chain ransomware attack” against Kaseya’s VSA product.
Supply chain attacks have crept to the top of the cybersecurity agenda after the United States accused hackers of operating at the Russian government’s direction and tampering with a network monitoring tool built by Texas software firm SolarWinds.
Kaseya has 40,000 customers for its products, though not all use the affected tool.
After years of warnings, the impact of ransomware finally hits home for regular people.
SAN FRANCISCO — It can feel abstract: A group of organized but faceless criminals hijacking corporate computer systems and demanding millions of dollars in exchange for their safe return. But the impact of these ransomware attacks is increasingly, unavoidably, real for everyday people.
These crimes have resulted in missed chemotherapy appointments and delayed ambulances, lost school days, and transportation problems. A ransomware attack on Colonial Pipeline in May led to gas shortages and even dangerous situations caused by panic buying. This past week, hackers compromised the JBS meat processing company, leading to worries about meat shortages or other key food providers being at risk. Last fall, the Baltimore County Public Schools system was hit with ransomware and forced to halt classes for two days, which were being held virtually.
As recently as Wednesday, ransomware attacks were causing problems across the country. In Martha’s Vineyard, the ferry service transporting people to and from the Massachusetts island said it had been hit by a ransomware attack that disrupted its ticketing and reservation process. Ferries continued operating all week, but the ticketing system was still affected, causing delays, on Friday.
The recent spate of high-profile ransomware incidents is exactly what cybersecurity professionals have been warning about for years. But it’s partially the impact on everyday people — far from the executive suites, cybersecurity companies, or government agencies that regularly fret about the criminal enterprise — that has made the risk more visible. The ripple effects of ransomware can result in everything from mild inconvenience to people losing their lives, and it’s only increased in frequency during the pandemic.
“It’s not only that it’s getting worse, but it’s the worst possible time for it to happen,” said Robert Lee, chief executive of Dragos, an industrial cybersecurity firm. He says on average, there are likely 20 to 30 big ransomware cases happening behind the scenes in addition to the ones making headlines.
Ransomware attacks are not new. The money at stake has changed drastically, however, inflating from thousands to millions of dollars, and the targets are more sophisticated as well. The increasing number of companies connecting their systems and adding more remote access points, along with things like the widespread use of bitcoin, have widened the pool of targets. Cybercriminals once focused on small companies and individuals but have made headlines this year for attacks on higher-profile victims.
“Now you’ve got ransomware affecting whole corporate networks, interrupting critical national function, causing disruption in people’s lives. It’s really become a national security, public health and safety threat,” said Michael Daniel, president and CEO of the nonprofit group Cyber Threat Alliance.
The ransomware industry has grown but the underlying techniques for gaining access have largely stayed the same. Hackers commonly access companies’ systems through “phishing” attacks — emails sent to try to trick employees into giving up passwords or access. Once inside a company’s system, ransomware outfits will find critical information and lock it down, then contact a company to demand a ransom for it to be released.
These criminals generally work in loosely defined groups, sharing tips and resources that make it possible for individual hackers to easily extort multiple targets. Companies occasionally have backup copies of their systems that they can restore rather than pay a ransom. But that can result in delays, and sometimes hackers make copies of the information they access and threaten to leak private information online if they are not paid. A big data leak could be a huge issue for consumers, not just the companies.
“There’s this awful downward spiral of societal harm that happens from ransomware,” said Megan Stifel, co-chair of the ransomware task force and an executive director at the Global Cyber Alliance.
The Colonial Pipeline attack was one of the many worst-case scenarios experts have been warning about, and planning for, for years. A ransomware attack last month caused the company to shut down its pipeline connecting Texas to New Jersey.
Panicked that they wouldn’t be able to get enough fuel, drivers swarmed gas stations, resulting in long lines and barren gas pumps in parts of the U.S. Drivers hoarded fuel as stations ran out of their supply, exacerbating the issue. The attack sparked a real-world fire in a Florida town, according to local news reports, when a Hummer burst into flames after the driver filled up four gas containers. The panic buying even prompted the U.S. Consumer Product Safety Commission to issue a long tweet thread about gas safety, including a message that quickly went viral: “Do not fill plastic bags with gasoline.”
People’s safety has been even more directly threatened by attacks on health care systems. Hospitals have been particularly hard hit, as far back as 2016 when the Hollywood Presbyterian Medical hospital paid $17,000 in bitcoin to a ransomware hacker. Last November, the University of Vermont Medical Center was hit by ransomware and it took nearly a month for it to regain access to its medical records. Chemotherapy patients had their treatments delayed, and were sent to other health centers where some had to recreate their medical history.
Joshua Corman, the chief strategist for health care and covid on the government’s Cybersecurity and Infrastructure Security Agency COVID Task Force, has been studying the potential impact of health-care attacks on mortality rates. For example, if a hospital has to close suddenly, ambulances might take longer to reach people in distress.
“Minutes can be the difference between life and death for heart attacks, and hour or two can be the difference for a stroke,” said Corman.
Lee, the head of Dragos, recently worked with a power company that got hit with a ransomware attack but was able to maintain operations. However, attacks like that could easily result in localized power shortages, he says. Attacks on pharmaceutical companies, or any of the manufacturers in their pipeline, could delay critical medicine like insulin or even vaccines. The increased targeting of industries with the most potential for disruption may be the criminals’ business decision.
“It feels like these groups realize industrial companies are more ready to pay out and more quick to pay out, because if you impact industrial operations you have to get up and going for safety and community,” said Lee.
Beyond the physical inconveniences, ransomware attacks can also hurt public trust in technology and systems, and cause people to worry they’ll be a victim or to panic-buy products they think will see a price hike or be in short supply, according to Stifel.
Panic after attacks is part of the problem. This past week’s attack on JBS, one of the largest meat-processing companies in the world, resulted in temporary factory shutdowns. While there were not yet any confirmed meat shortages in the U.S., worried meat suppliers still warned consumers not to panic buy beef, which could cause otherwise still stable prices to go up.
From higher gas prices to canceled surgeries, real-world financial and consumer safety implications of these hacks have spurred the federal government to crack down on ransomware. It’s investigating the causes, working on guidelines, and urging corporate America to take cybersecurity protections seriously.
“We’ve been warning about this overtly for more than eight years and a lot more quietly for longer, but now that its manifested, the silver lining is that we’re not starting ice cold,” said CISA’s Corman.
Any time is too long, but hackers are finding ways to wander through networks unseen for longer than you might expect.
Cyberattackers on average have 11 days after breaching a target network before they’re being detected, according to UK security firm Sophos – and often when they are spotted it’s because they’ve deployed ransomware.
As Sophos researchers note in a new report, that’s more than enough time for an attacker to get a thorough overview of what a target network looks like, where its weaknesses lie, and for ransomware attackers to wreck it.
Sophos’ data, based on its responses to customer incidents, suggests a much shorter “dwell time” for attackers than data from FireEye’s incident response team, Mandiant. Mandiant recently reported the median time-to-detection was 24 days, which was an improvement on previous years.
Sophos explains the relatively short dwell time in its incident response data is because a whopping 81% of incidents it helped customers with involved ransomware – a noisy attack that immediately triggers alarms for tech departments. So while shorter dwell times might indicate an improvement in so-called security posture, it might also be just because file-encrypting ransomware is a disruptive attack compared to data theft.
“To put this in context, 11 days potentially provide attackers with approximately 264 hours for malicious activity, such as lateral movement, reconnaissance, credential dumping, data exfiltration, and more. Considering that some of these activities can take just minutes or a few hours to implement, 11 days provide attackers with plenty of time to do damage,” notes Sophos in its Active Adversary Playbook 2021 report.
The vast majority of incidents Sophos responded to were ransomware attacks, suggesting the scale of the problem. Other attacks include stealing data, cryptominers, banking trojans, data wipers, and the use of penetration testing tools like Cobalt Strike.
Another notable point is the widespread use by attackers of Remote Desktop Protocol (RDP) with about 30% of attacks starting with RDP and 69% of subsequent activity being conducted with RDP. Phishing, on the other hand, was the entry point for just 12% of attacks, while 10% of attacks involved exploiting an unpatched system.
“RDP played a part in 90% of attacks. However, the way in which attackers used RDP is worth noting. In incidents that involved RDP, it was used for external access only in just 4% of cases. Around a quarter (28%) of attacks showed attackers using RDP for both external access and internal movement, while in 41% of cases, RDP was used only for internal lateral movement within the network,” Sophos threat researchers note.
Sophos also compiled a list of the most widely observed ransomware groups. DarkSide, a newish but professional ransomware service provider that started activity in mid-2020, only accounted for 3% of cases Sophos investigated through 2020. It’s in the spotlight because of the attack on Colonial Pipeline, which reportedly paid $5 million to the group.
DarkSide offers its ransomware as a service to other criminal groups who distribute the ransomware, much like the REvil ransomware gang does. REvil was in the spotlight last year because of attacks on government and healthcare targets plus for its high ransom demands that averaged about $260,000.
Other significant ransomware players including Dharma, Maze (defunct), Ragnarok, and Netwalker (defunct).
US president Joe Biden last week said he discussed the Colonial ransomware attack with Moscow, and suggested Russia should take “decisive action” against these attackers. The US believes DarkSide is based in Russia but not connected to the Russian government.
“We have been in direct communication with Moscow about the imperative for responsible countries to take decisive action against these ransomware networks,” said Biden on May 13.
Not a week goes by anymore, it seems like, when we don’t have multiple hacks to report on, as well as a fresh data breach or systems intrusion on the part of attackers constantly probing for weaknesses anywhere that consumer records are stored.
Many of these episodes garner headlines simply because of the scale of the data breach and the target of the attack. Facebook is one example of this, as the social network is still facing an onslaught of criticism online over the revelation from this past weekend that the company has suffered yet another embarrassingly massive data leak — encompassing personal information from more than 533 million Facebook users across 106 countries. Meantime, hackers themselves are also getting hacked, as word of a separate breach at a hub for stolen data has also just been reported.
Threat research firm Group-IB posted a report on Thursday documenting how Swarmshop — described as a “neighborhood” store for stolen personal and payment records, such as credit card data — saw a major cache of its user and administrator data leaked online to another underground hacker forum. Appropriately, the title of the Group-IB report summarizing what happened here is “What Goes Around Comes Around,” but make no mistake — there’s just as good of a chance that your data may be caught up in this as there is that hackers acquired stolen data on other hackers.
According to the report on this hack, the Swarmshop database that was posted on a different underground forum contained 12,344 records of the card shop administrators, sellers, and buyers. That’s per a Twitter thread from Group-IB, which goes on to note that this database also “exposed all compromised data traded on the website, including 623,036 payment card records, 498 sets of online banking account credentials and 69,592 sets of US Social Security Numbers and Canadian Social Insurance Numbers.”
Given the nature of the treasure trove of data that Swarmshop represents, it should probably come as no surprise that this is also not the first time that the stolen data hub has found itself in the crosshairs of other cybercriminals. In January 2020, the site’s records were leaked on an underground forum, reportedly by a user motivated by revenge. Meantime, here’s what else we know about this new hack — the data dump included records on more than 623,000 payment cards, almost 63% of which were issued by US banks.
“While underground forums get hacked from time to time, cardshop breaches do not happen very often,” Group-IB CTO Dmitry Volkov said. “In addition to buyers’ and sellers’ data, such breaches expose massive amounts of compromised payment and personal information of regular users. Although the source remains unknown, it must be one of those revenge hacks cases. This is a major reputation hit for the card shop as all the sellers lost their goods and personal data. The shop is unlikely to restore its status.”
For the past several weeks, on tweeter and within the company, the chairman and CEO of Cisco Systems, Mr Chuck Robbins has been very vocal about the struggle for social justice; domestically and globally.
During the recent pandemic, Cisco donated $5M to the Equal Justice Initiative and other groups that are focused on fighting the lack of equal justice for all in our society. According to Mr Robbins, “CEO Action for Diversity & Inclusion™ is the largest CEO-driven business commitment to advance diversity and inclusion in the workplace.”
On June 23, Talos, Cisco’s research and development group joined their CEO to declare “There are many ways to respond to injustice, both large and small, but each response is important. While we acknowledge it is a small change, Cisco Talos is moving to replace our use of the terms “blacklist” and “whitelist” with “block list” and “allow list.” Even though these terms are commonly in use in the security industry, we will not go along with casually assigning positive connotations to “white” while assigning negative connotations to “black.” We stand by Cisco CEO Chuck Robbins”. https://blog.talosintelligence.com/
This action may seem small, but for the security industry, if other vendors would follow along with Talos’s decision, this would be a major evolution and will constitute a big win for Cisco and Mr Robbins in his fight for Social Justice and equality for all people.
1. Password-protect your smart devices, both at the lockscreen level and after logging in. This is particularly necessary for your smartphones and tablets
2. If you have a home network, be sure to protect your Wifi with passwords that are not easily decoded. Remember the bad guys are looking for easy access
3. If you’re into IoT and have remote-controlled appliances, anti-virus software may be helpful in keeping away the bad guys. Anti-virus also helps with your laptops or PCs
4. Whether you keep your data on your local disk or remote site (cloud), you’re not safe from attacks. Practicing simple online hygiene as recommended can go a long way in keeping us safe online.
Whatever you do, STOP, THINK, and CONNECT. Stay safe online.
The most basic and fundamental protection you need as you engage in online activities is to make sure you have a password that is not easy to decode. The following are some Best Practices for protecting your user password:
1. Make sure you don’t share your password with other people, including members of your immediate family (wife, husband, children). Similarly, don’t use the same password for all your online accounts
2. Do not use easy to guess passwords, like date of birth, Driver’s License Number or Social Security Number (if applicable). For example, don’t use password123 or password. Be creative by using a password that includes Letters, Symbols, and Alphabet; e.g. S%&5thinking
3. If your email account is compromised, be sure to Reset your password immediately
4. If you use different passwords for your online accounts, try and use a Password Manager program versus saving your password in a browser. Be secure to clear the cache of your browser if you use a public computer for your transactions
5. Make sure your password complies with the requirements of the site provider.
The term Digital Security means different things to different people. I asked a friend what they understood by this term and they said, “it means being conscious of what you send with your gadgets”.
In the new world of Internet of Things (IoT), the importance of securing one’s privacy and data cannot be over emphasized. In addition to IoT, the proliferation of social media platforms has created its own set of challenges for users. In particular, without realizing it, we leave a digital footprint anytime we go online and conduct a transaction, ranging from banking to setting up a new email account or joining the likes of Facebook, LinkedIn, Twitter, to name a few of the popular ones.
As these new ways of communication and life styles take over, we need to be aware of the exposures and how a nefarious action by a “bad guy” can make our lives miserable. Digital Security or Information Security is the branch of Information Technology that focuses on the protection of our online activities. The bad guys (actors) are becoming more sophisticated and protecting yourself or identity online should be taken very seriously.
It was the night of Feb 15, 2006. John logged into his online bank account from the comfort of his home and discovered a strange check has been cashed on his account. Because he usually doesn’t write checks with such large amounts, he was very suspicious of the transaction. The next morning, John went to the bank and the inevitable had happened. Though the Bank refunded all the amount on the check, John has just been introduced to the world of Identity Theft. ID Theft is when someone steals your personal information and use your name to open accounts or transact other businesses to make money without your knowledge. This can happen online or if you lose your documents. Our example relates to online ID Theft. Unlike John, you may not realize this has happened until you decide to transact a business with your accounts. The phenomenon is so common that the need to protect ourselves and our personal information online is one of the most popular areas of study in the 21st century.
John’s experience is not uncommon anymore, however, the resolution depends on where you live. Although John got his money back from the bank, the effect of identity theft can linger on for years. Identity theft is a very lucrative business and some bad guys do it for fun while others do it for the monetary gain. Failing to protect ourselves can leave us vulnerable to the negative effects of identity theft. And by the way, these are not limited to big companies anymore. To protect yourself adequately, look for tools like anti-virus software, and secure your smartphones through available biometric methods such as fingerprints or iris scanning, also look for smart card-based or SIM card protection to secure your mobile devices. Knowing the tools is one thing but understanding and practicing some basic digital security hygiene can go a long way in keeping you safe while navigating the world wide web of information.
